Extend 4829e60 with support for exposing full user object

If token.user is set in the token passed back from getAccessToken
this will be what's exposed in req.user, otherwise it will fallback
to the previous behaviour of { id: user_id }
Improve README

Add features/limitations + define what "client" returned from
getClient should look like